>It's not ethical to correlate a user's sessions using etags when they have cleared cookies and caches (or set DNT header). You are expressly behaving against t

>It's not ethical to correlate a user's sessions using etags when they have cleared cookies and caches (or set DNT header). You are expressly behaving against the user's wishes, and there really is no difference in exploiting the browser in other ways to reveal other personal information. You don't see a difference between analyzing the data a browser gives back during normal operation and exploiting security bugs to force browsers to give up information that is supposed to be private? They're tracking your session based on the data that your browser normally sends. They're not crossing any boundaries or stealing any secrets. The difference between using ETags and exploiting a bug to get secret information is that ETags were never meant to be secret or private. No one thinks they're "personal information". They're normal information that happens to be useful for uniquely identifying a user, as are Flash cookies. The customer can ask politely not to be identified, but there is no reason that companies have to automatically consider that an ethical obligation just because customers wish it was that way. Customers also wish everything was free. If you feel browsers should support completely untraceable sessions, that's a feature request. It's not an ethical violation on the part of others that they're not imagining this feature already exists. >Did you even read my original comment? Privacy sensitive people and people that don't like ads are not the same set of people. Stop using ad blockers as a justification for unethical privacy violations. We're not talking about specific people, we're talking about general principles. If ad blockers are not unethical in principle, then neither is server-side session tracking, because both stay 100% within the technical bounds without coercing any information from or disrupting the ordinary operation of the other party. It seems that your conception of ethics really does boil down to "the customer wants it", so it's going to be hard to continue this conversation.